CLEANSTART-2024-MV49832 incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to t...

🗓️ 30 Sep 2026 19:17:35Reported by GoogleType

osv🔗 osv.dev👁 2 Views

Incorrect supplementary group handling in Buildah leads to information disclosure or data modification.

Reporter	Title	Published	Views	Family All 155
attackerkb	CVE-2022-2990	13 Sep 202214:15	–	attackerkb
Tenable Nessus	AlmaLinux 8 : container-tools:rhel8 (ALSA-2022:7457)	12 Nov 202200:00	–	nessus
Tenable Nessus	AlmaLinux 8 : container-tools:rhel8 (ALSA-2022:7822)	14 Nov 202200:00	–	nessus
Tenable Nessus	AlmaLinux 9 : buildah (ALSA-2022:8008)	19 Nov 202200:00	–	nessus
Tenable Nessus	AlmaLinux 9 : podman (ALSA-2022:8431)	18 Nov 202200:00	–	nessus
Tenable Nessus	CentOS 8 : container-tools:rhel8 (CESA-2022:7457)	9 Nov 202200:00	–	nessus
Tenable Nessus	CentOS 8 : container-tools:rhel8 (CESA-2022:7822)	8 Nov 202200:00	–	nessus
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: crit / criu / criu-debuginfo / criu-debugsource / criu-devel / etc Multiple Vulnerabilities (ciqsa-2026_0898)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: libslirp / libslirp-debuginfo / libslirp-debugsource / etc Multiple Vulnerabilities (ciqsa-2026_0899)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: containernetworking-plugins / containernetworking-plugins-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0902)	1 Oct 202600:00	–	nessus

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2024/CLEANSTART-2024-MV49832.json
osv	www.osv.dev/vulnerability/CVE-2022-2990
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-2990

01 Oct 2026 00:45Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.19.8

EPSS0.00349

Buildah information disclosure data modification supplementary groups container engine